Privacy

ShareCo is a Salesforce consultancy and training business operating from Vancouver, British Columbia. We are the organisation responsible for the personal information described here. [Legal entity name and postal address to be confirmed.]

Privacy questions, access requests and complaints go to privacy@shareco.ca. A named person on our team owns that inbox and answers it. We aim to respond within five business days and to resolve access requests within thirty days, which is the period British Columbia law sets.

Most privacy notices blur these together. They carry different risk and different rules, so we keep them apart.

Enquiry data

What you type into the contact form on this site, plus the email thread that follows. Held by ShareCo. Small, and entirely under our control.

Academy account data

Your name, work email, organisation, course progress, assessment scores and any certificate we issue. Held by ShareCo because a certificate has to stay verifiable after you finish.

Client system data

The records inside your Salesforce org, your accounting system and your other connected tools. This is yours. It stays in your systems. We work inside them rather than copying them out.

• The fields you submit on the contact form: your name, work email, company, Salesforce edition, what you are trying to do, and your deadline.
• Standard web server logs, including IP address, user agent and requested path, kept for security and debugging.
• If you allow analytics, Google Analytics receives visits to our public pages and uses a first-party identifier for up to 60 days. We exclude form contents, URL query strings and fragments, disable advertising features, and do not use analytics to identify you for sales outreach. You can change your choice through Analytics preferences at the bottom of public pages.

We do not run advertising pixels, we do not sell or rent contact details, and we do not add anyone to a mailing list from a contact form submission. Newsletter subscription is a separate action you take on purpose.

Account

Your name, your email address and a hash of your password. We never see or store the password itself.

Sign-in sessions

The IP address and browser user agent of each signed-in session, kept to spot a session you did not start.

Learning

Your enrolments, lesson progress, the answers you submit to graded activities, your scores, XP, badges and any certificate we issue.

Labs

The pass or fail result of each lab check you run against your own practice org. The check sends counts and names, never the records in that org.

Employer seats

If your employer gave you a seat, the people who run that organisation in the Academy see your progress, scores and certificates for the courses they assigned.

Colleagues see you on a leaderboard only if you turn that on in your account privacy settings. It is off until you do.

The Academy sets one cookie, which keeps you signed in. It lasts 7 days and is renewed once a day while you use the Academy. It is strictly necessary. There are no analytics or advertising cookies, so there is no cookie banner.

The lesson player also keeps your place in a course, and a few display choices, in your own browser storage. That stays on your device and is never sent to us.

During an engagement we work inside systems you own. The controls are described in full on the security page. The privacy-relevant parts are these.

• Access is granted to named individuals at ShareCo, under your own user administration, with the permissions the work requires and no more. You can revoke it yourself at any time without asking us.
• We do not export production data to our own machines as a matter of course. Where a specific piece of analysis needs an extract, we agree the scope first, work in a location you control where possible, and delete the extract when the analysis is signed off.
• Test records we create while verifying work are deleted once verification is complete. Where a record cannot be deleted, we tell you which one and why.
• Person-level data is not sent to AI models. Where a model is used on your records, the inputs are minimised to what the task needs, and contact names are excluded from prompts.
• Screenshots and written documentation that leave your org are redacted before they do.

For enquiry and Academy data we rely on your consent, given when you submit a form or create an account, and on the legitimate need to perform the contract you have entered into with us. You can withdraw consent for marketing at any time without affecting service delivery.

For client system data we act as a service provider to you. Your own privacy obligations to your customers and staff continue to apply, and our engagement letter records that we process that data only on your instructions.

We operate under the federal Personal Information Protection and Electronic Documents Act and, for private-sector activity in our home province, the British Columbia Personal Information Protection Act.

We use third-party providers for video, file storage, email and payment processing. Some of them store data in the United States, which means that data can be subject to lawful access requests under United States law. We state that plainly rather than burying it.

Stripe

Payments. Receives your email address and the order. Card details go straight to Stripe and never reach us.

Mux

Course video. Your browser streams lessons from Mux, so Mux sees the requests it makes.

Cloudflare

File storage for certificate PDFs and course files.

Resend

Email. Receives your email address and the message: sign-in links, invitations, receipts and certificates.

Hosting

The website, the Academy and its database run on servers we manage ourselves. [Hosting provider and region to be confirmed.]

Each provider receives only what its part of the service needs. We will tell you what any one of them holds about you on request to privacy@shareco.ca.

Client system data is a deliberate exception. It stays in the systems you already run, under whatever residency terms you have agreed with those vendors. We do not add a hop.

Enquiries that did not become work

Deleted 24 months after the last message in the thread.

Engagement records

Kept for 7 years after the engagement ends, because tax and professional record-keeping rules require it. Working extracts are deleted much earlier, at sign-off.

Academy accounts and certificates

Kept while the account is active. A certificate record is kept indefinitely so its public verification link keeps working, because a credential nobody can check is worthless. You can ask us to revoke and delete one.

Academy sign-in sessions

Deleted when they expire, 7 days after last use, or when you sign out.

Grading and completion records

Grading records are kept at least one year and completion evidence seven years, because an employer may need them for a training grant claim.

Server logs

Kept for 90 days, then deleted.

• Ask what personal information we hold about you and get a copy of it. Academy learners can download their own learning record at any time from the privacy page in their account.
• Ask us to correct anything that is wrong.
• Withdraw consent, subject to legal and contractual obligations that we will name if any apply.
• Ask us to delete what we hold, where we are not required to keep it.
• Complain to us first, and then to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada if you are not satisfied.

We do not charge for access requests. We will confirm your identity before releasing anything, because handing your data to someone impersonating you is the failure that matters most here.

These rights come from the federal Personal Information Protection and Electronic Documents Act and the British Columbia Personal Information Protection Act.

ShareCo Academy is workplace training for people aged 18 and over. We do not knowingly create accounts for anyone younger.

If we confirm an incident affecting your data, we tell you within one business day of confirming it, with what we know, what we do not yet know, and what we are doing. We do not wait for a complete picture before the first message.

Where a breach creates a real risk of significant harm we report it to the Office of the Privacy Commissioner of Canada and notify affected individuals, as federal law requires. We keep a record of every breach for at least 24 months, including the ones that did not meet the reporting threshold.

When this notice changes we update the date at the top. If a change materially affects how we handle personal information, we email account holders rather than relying on you to re-read the page.